Speaker 1: Brought to you by the reinvented two thousand twelve camera.
Speaker 1: It's ready. Are you get in touch with technology? With
Speaker 1: tech Stuff from how stuff looks dot com. Hello again, everyone,
Speaker 1: Welcome to tex Stuff. My name is Chris Polett, and
Speaker 1: I'm an editor at how Stuff works dot com. I'm
Speaker 1: trying to crack up the person sitting across from me,
Speaker 1: and that's the person I usually talked to on these podcasts.
Speaker 1: His name is Jonathan Strickler and and he is a
Speaker 1: senior writer here. To get there, you follow Highway fifty
Speaker 1: eight going northeast out of the city, and it is
Speaker 1: a good highway and New all right, We're we're talking
Speaker 1: about numbers today, Yes we are. We're talking about getting
Speaker 1: to where you're going and getting diverted along the way. So,
Speaker 1: as of the recording of this podcast, which is in
Speaker 1: April of there is a story that's actually not a
Speaker 1: news story necessarily. It first started to kind of make
Speaker 1: the New is way back in November, but it's kind
Speaker 1: of sort of bubbled up and it's an operation that
Speaker 1: the FBI, the Federal Bureau of Investigations, has headed up
Speaker 1: and it all involves hacking into the Internet and uh,
Speaker 1: and and messing around with Internet traffic. It's called Operation
Speaker 1: Ghost Click. That's a nice name. I always love hearing
Speaker 1: the operation names. It is a wacky doctors game. So um,
Speaker 1: I think first, before we get into too much detail,
Speaker 1: we should probably talk about how internet traffic works. We've
Speaker 1: mentioned that on the podcast on a handful of occasions.
Speaker 1: I think when in fact we got into the domain
Speaker 1: name system DNS system or sorry that was redundant, the
Speaker 1: d N s uh no was servers um Well are
Speaker 1: both because DNS can can mean both, but right, right, right,
Speaker 1: So yeah, we talked about it before. And basically every
Speaker 1: website has a is um as an address, a physical address,
Speaker 1: well physical address on on a hard drive, a physical
Speaker 1: hard drive somewhere, and these numbers, there are are four
Speaker 1: sets of numbers separated by periods, and that address is
Speaker 1: unique to that um space on that physical hard drive somewhere.
Speaker 1: And so if you typed in UM h T T
Speaker 1: P colon slash slash and these this number, you will
Speaker 1: get to a website. Of course, that's very inconvenient because
Speaker 1: then you either have to write down these numbers or
Speaker 1: bookmark them or you know, yeah, you have to have
Speaker 1: some sort of weird total recall thing going on where
Speaker 1: you can just easily remember any series of numbers, which would,
Speaker 1: uh would would make you incredibly useful, but it would
Speaker 1: also make you very rare. Most of us, most of
Speaker 1: us are just not It's not something humans are particularly
Speaker 1: good at doing on average. So that is what kind
Speaker 1: of gave rise to the idea of having this domain
Speaker 1: name system. Yes, now, domain name system, what it does
Speaker 1: is it allows you to create a domain name as
Speaker 1: in words that correspond to whatever your site is, and
Speaker 1: then that itself is mapped to this series of numbers,
Speaker 1: this i P address right, the i P being Internet
Speaker 1: protocols UM, which is the the language that gets uh,
Speaker 1: you know, you from one place to another on the Internet,
Speaker 1: regardless of whether you're using a Windows machine, Mac or
Speaker 1: Linux or mobile thing. It gets you to the same place.
Speaker 1: And what allows you to type in how stuff works
Speaker 1: dot com and get to our website. Yes, so if
Speaker 1: you were to type how stuff works dot com, what
Speaker 1: happens is that request you know, what you're essentially doing
Speaker 1: is you're telling your browser I want access to this
Speaker 1: particular website. Your browser sends this message along up a
Speaker 1: chain of command, and uh, you know, it has to
Speaker 1: go out to the right computer that has the website
Speaker 1: living on it and retrieve that so that you get
Speaker 1: an instance of it back at your machine. In order
Speaker 1: to do that, it has to first map that what
Speaker 1: needs to have is the name that you're typing. It
Speaker 1: has to be mapped to that physical machine, that physical drive, uh,
Speaker 1: and it does this by going through domain name servers.
Speaker 1: A domain name server is essentially like think of it
Speaker 1: kind of like a phone book. Yeah, so that all
Speaker 1: the different u r l s you could type in
Speaker 1: are indexed against these number numerical addresses. And then that way,
Speaker 1: once you type in the u r L, it looks
Speaker 1: for the corresponding numeric address, pulls information from that that
Speaker 1: particular source, and then serves it back to you so
Speaker 1: that you get what you asked for. Well that you
Speaker 1: asked for it, you got it anyway. So, um, the
Speaker 1: whole deal here is that you are going to get
Speaker 1: the right information assuming that everything's working correctly, and occasionally
Speaker 1: stuff messes up. There might be uh the computer that
Speaker 1: hosts the site might be down, in which case you're
Speaker 1: going to get something like a four or four error
Speaker 1: because the Internet is not going to be able to
Speaker 1: find the file that you've requested. Very sorry, the Internet
Speaker 1: is broken. The elders of the Internet called and they said,
Speaker 1: no more Internet for you. But most of the time
Speaker 1: it's gonna work just fine. However, what happened in the
Speaker 1: case of Operation ghost Click is that, uh, the FBI
Speaker 1: discovered there were some people who had created some rogue
Speaker 1: DNS servers. So, in other words, these get these folks,
Speaker 1: six Estonian nationals, according to the FBI, um got together
Speaker 1: and created these servers that acted just as a domain
Speaker 1: named server would. So in other words, it had a
Speaker 1: collection of u r l s and index of u
Speaker 1: r l s and an index of addresses numeric addresses.
Speaker 1: So it's like a fake phone book, right exactly. Some
Speaker 1: of the entries in this fake phone book went to
Speaker 1: different phone numbers, so instead literally, yeah, but we're since
Speaker 1: we're sticking with the analogy, sticking with that analogy. So
Speaker 1: instead of the official phone number for a particular website,
Speaker 1: you would get a fake one, and it would, in
Speaker 1: other words, that you would go to a fake numeric
Speaker 1: address for a real site, so you might type in
Speaker 1: the address perfect in your u r L bar. Right,
Speaker 1: So let's take a random example let's just say Yahoo.
Speaker 1: So you do www dot Yahoo dot com, you hit enter. Now, normally,
Speaker 1: in a regular DNS server, it would look up that
Speaker 1: you are L, look to see what the numeric address
Speaker 1: is for that u r L, send that information out,
Speaker 1: retrieve the website, and serve it up to you. A
Speaker 1: rogue DNS server would look up that u r L,
Speaker 1: look at the numeric address that was created for that
Speaker 1: u r L. But it isn't actually the address for Yahoo.
Speaker 1: It's an address for something else, and it serves that
Speaker 1: up to you. Now, why would anyone do this? There
Speaker 1: are a couple of different reasons. Now, in the case
Speaker 1: of the Estonians and uh, they were doing something I
Speaker 1: think that was kind of uh deediously clever. They were
Speaker 1: doing this in order to reroute traffic to break in
Speaker 1: advertising money. So, in other words, what they wanted to
Speaker 1: do was the way advertising on the internetworks in general
Speaker 1: is that you get paid for a certain number of
Speaker 1: views of that ad It's called impressions. The number of
Speaker 1: impressions and ad gets that translates to money, And if
Speaker 1: you get lots and lots and lots of impressions, you
Speaker 1: get lots of money. Um. Then in general, a single
Speaker 1: impression is worth a fraction of assent. Yeah, but if
Speaker 1: you can say, hey, you know, I can promise you
Speaker 1: that five million people are going to see your ad,
Speaker 1: then you can command a good price for your services. Right, So,
Speaker 1: very popular websites can tend to charge more than sites
Speaker 1: that don't get a lot of traffic. Makes sense, Right,
Speaker 1: Let's say that you have a billboard next to a
Speaker 1: busy highway. That the price for that billboard to to
Speaker 1: to put it out on that billboard, it's probably gonna
Speaker 1: be higher than a billboard that's next to a rural
Speaker 1: road that doesn't get a lot of traffic. So anyway,
Speaker 1: the same sort of logic applies on on the web.
Speaker 1: So what these guys were doing, I say, guys, what
Speaker 1: these Estonians were doing because I don't know their gender, Uh,
Speaker 1: they were they were using these rogue DNS servers to
Speaker 1: reroute traffic to go to different websites and that had
Speaker 1: specific ads on them that the Estonians were administering, and
Speaker 1: then they were pulling in the money. So they were
Speaker 1: redirecting traffic. It's like putting in a detour in your route,
Speaker 1: and so you're going down your normal route to to
Speaker 1: wherever you're going, and you see a sign and says, oh, nope,
Speaker 1: the road is out up ahead, take a right instead
Speaker 1: of going straight, and you will go through a different route.
Speaker 1: And along that route you decided to stop and eat.
Speaker 1: And normally you would stop and eat at your favorite restaurant,
Speaker 1: but you can't get to that one because it's on
Speaker 1: the road that's been closed. So you go to this
Speaker 1: other restaurant and it all turns out that it was
Speaker 1: employed by the other restaurant in the first place. They
Speaker 1: put that detour sign up because they wanted to get
Speaker 1: some more foot traffic or some more some more diners
Speaker 1: to come in. That was the general plan. Now the
Speaker 1: question is how do you get that rogue DNS server
Speaker 1: to get in the line of traffic so that people
Speaker 1: will visit it in the first place. Yeah, because if
Speaker 1: you're typing in an address that you already know, say
Speaker 1: Discovery dot com, you should theoretically be routed to the
Speaker 1: right place as long as your computer is configured correctly
Speaker 1: and the internet's working the way it's supposed to. I mean,
Speaker 1: what are they gonna do. Are they gonna go in
Speaker 1: and kick out the legitimate DNS machine and replace it. No,
Speaker 1: it was very clever. They created a kind of malware,
Speaker 1: and the malware is essentially called d n s changer,
Speaker 1: and so DNS changer would change the DNS settings on
Speaker 1: your computer or other device, or even router, which was
Speaker 1: particularly nasty because if it changed on the router, then
Speaker 1: any device that connects through that router would be affected. Also,
Speaker 1: it's unlikely that you're going to have anti virus software
Speaker 1: on your router, although you might on your computer now.
Speaker 1: The way that they did this with the router was
Speaker 1: the easiest way, and it's the easiest way for someone
Speaker 1: to prevent it from happening to them. The way that
Speaker 1: worked on the router was that they just ended up
Speaker 1: using a list of generic user names and passwords that
Speaker 1: are that tend to be UMU administered over various routers.
Speaker 1: So you pick pick a router, like whatever router you
Speaker 1: you happen to use, that router tends to have a
Speaker 1: standard user name and standard password you are supposed to
Speaker 1: change once you install it into your home network, but
Speaker 1: a lot of people never get around to doing that.
Speaker 1: They install the the the router and then they don't
Speaker 1: bother changing the user name and password, which means that
Speaker 1: anyone who knows what the standard user name and password
Speaker 1: is for that brand of router could get access to
Speaker 1: that network. That's what they were doing in this case.
Speaker 1: But in order to change the computers themselves, not the router,
Speaker 1: what they had to do was convince people to download
Speaker 1: some malware and execute that. Now social engineering, Yeah, lots
Speaker 1: of different ways of doing that. Yeah, you know, there's
Speaker 1: the very standard way where they include some uh they
Speaker 1: put on on a website that you might encounter a
Speaker 1: little pop up that says, hey, you're anti virus software
Speaker 1: is out of date. Install this and we will scan
Speaker 1: your computer for viruses and free, yeah, for free. And
Speaker 1: in fact it really is a virus itself that installs
Speaker 1: to your computer. You know, you think you are trying
Speaker 1: to head off some sort of malware and in fact
Speaker 1: you're actually installing malware to your computer at the time.
Speaker 1: Or it could be through email attachments, you know, all
Speaker 1: the standard ways that malware propagates across the web, any
Speaker 1: of that would work to get this this particular kind
Speaker 1: of malware onto your machine. Once you installed it, whether
Speaker 1: it was through a trojan program or whatever, it would
Speaker 1: go and reset the DNS settings on your computer, and
Speaker 1: it would direct your computer to go to these rogue
Speaker 1: DNS servers as opposed to your Internet service providers DNS servers,
Speaker 1: because h I SP has its own right that passes
Speaker 1: the information up along the chain of command. So uh,
Speaker 1: you would bypass your I s P S servers. You
Speaker 1: would go to these rogue servers, and then you would
Speaker 1: be directed to whatever website they wanted to direct YouTube
Speaker 1: for any particular u r L. For some u r
Speaker 1: l s, you might just get the regular website you
Speaker 1: you're sent along and nothing bad happen. For other u
Speaker 1: r l s, you might be directed to a site
Speaker 1: that looks very similar to the one you wanted, but
Speaker 1: something isn't quite right, and it tends that again, they
Speaker 1: were just doing it for the advertising money. The scary
Speaker 1: thing is they could have done this for any other
Speaker 1: reason and actually tried to steal stuff directly from the user.
Speaker 1: Now in this case, that doesn't seem to be what
Speaker 1: they were up to. They were up to just redirecting
Speaker 1: that traffic. So you might think, well, that's annoying. I mean,
Speaker 1: I'm not going to get to the website I want
Speaker 1: to go to unless I type in the actual uh,
Speaker 1: numeric address physically, then I would go to it. But UH,
Speaker 1: while it's annoying that I wouldn't go to the site
Speaker 1: that I wanted to go to, at least they're not
Speaker 1: stealing from me. But they could have. They could have
Speaker 1: directed things so that you would go to dummy websites
Speaker 1: that look similar to official ones and put in a
Speaker 1: system where you type in your user name and password
Speaker 1: and they would log it. They could have logged it,
Speaker 1: they didn't. They could have logged that information, thus getting
Speaker 1: access to various accounts across the net. They could have
Speaker 1: gotten access to email accounts, bank accounts, you know, any
Speaker 1: other sort of anything that would require authorization. They could
Speaker 1: have done that. Uh, And what would probably have happened
Speaker 1: is that you would have logged in. Let's say that
Speaker 1: you try to go to your banks online banking site,
Speaker 1: and you might get a site that looks very much
Speaker 1: like your banks site. In fact, it might even look
Speaker 1: almost identical. Um, the address might look a little hinky,
Speaker 1: but if you were to type an years the name
Speaker 1: and password, likely you would get a response saying, oh,
Speaker 1: sites down for maintenance. But what's really happened is that
Speaker 1: that information has been logged by hackers, so that could
Speaker 1: have happened, or they could have directed you to a
Speaker 1: site where you would have been encouraged to download even
Speaker 1: more malware, perhaps a back door access programs that you
Speaker 1: are your computer would become part of a bot net
Speaker 1: or any other kind of of hacking tool. It's it's
Speaker 1: really the options are pretty much unlimited. Now. In this case,
Speaker 1: again it was just to redirect traffic. However, there were
Speaker 1: some other problems that would happen if you were affected
Speaker 1: by this virus. You might not you know, you might
Speaker 1: not have anyone stealing from your bank account or anything.
Speaker 1: But one of the things the virus does, which is
Speaker 1: pretty much standard operating procedure for viruses, is it turned
Speaker 1: off the features on your operating system and your anti
Speaker 1: virus from updating, so that you wouldn't be able to
Speaker 1: get the latest security patches that would prevent this this
Speaker 1: UH program from working. So first step pretty much of
Speaker 1: any malware is let's disable the stuff that can turn
Speaker 1: this off. So anything that would automatically turn the malware
Speaker 1: off was disabled. So that's a problem because it means
Speaker 1: that even if you aren't being actively preyed upon by
Speaker 1: these particular hackers, uh, future attacks could hit you much
Speaker 1: more easily because you are no longer protected it, yeah,
Speaker 1: which is pretty bad. That's what we call a bad
Speaker 1: thing and internet security. And they were about what four
Speaker 1: million people around the world and about a hundred countries
Speaker 1: that were affected by this, and then five thousand in
Speaker 1: the United States. And it wasn't just uh, you know,
Speaker 1: citizen users, it was also businesses, government, government computers. UM.
Speaker 1: I think there were even like a couple of computers
Speaker 1: over at NASA that were affected to and uh. And
Speaker 1: the good news that we have is that the FBI
Speaker 1: arrested these six Estonian nationals that were identified as being
Speaker 1: part of this running actually running this ring. Yeah, they
Speaker 1: were going to try to have them extradited into the
Speaker 1: United States. Yeah. And they've also taken over the rogue
Speaker 1: DNS servers they have identified as being part of this,
Speaker 1: and those rogue DNS servers are now acting like legitimate
Speaker 1: DNS servers, which is great. That means that as a user,
Speaker 1: when you try to visit a website, you should get
Speaker 1: what you're supposed to get. However, there's a problem because
Speaker 1: as your computer is still have if you're affected, your
Speaker 1: computer still is directing you to the wrong set of servers.
Speaker 1: You're still getting the right result, but you're going and
Speaker 1: you're not going to the regular chain of command that
Speaker 1: you should go to. And the FBI is not going
Speaker 1: to be running these servers forever, and in fact, in
Speaker 1: in July, they're going to turn them off. And once
Speaker 1: those turn off, if your computer is being directed to
Speaker 1: those DNS servers, you may not have any more Web access,
Speaker 1: at least not through typing in a normal u r L,
Speaker 1: because your computer is going to try and go through
Speaker 1: a pathway that doesn't exist anymore. So the important thing
Speaker 1: to do is to determine whether or not your computer
Speaker 1: has this infection, and if it does have the infection,
Speaker 1: to clear it up. And uh, it's the first one
Speaker 1: is easier than the second one. Yeah, the FBI actually
Speaker 1: set up a website designed to help you identify whether
Speaker 1: or not you have been affected. Yes, um, you can
Speaker 1: go to the FBI's website and follow the links to
Speaker 1: find out about whether or not your computer has this problem.
Speaker 1: And there's actually a couple different ways of doing it.
Speaker 1: There's they've they've set up a u r L where
Speaker 1: what it does is it pings a server and if
Speaker 1: it gets a positive results saying that you're fine. Uh,
Speaker 1: you get a screen that has this big green icon
Speaker 1: on it and says you're good. Um. If you're not fine,
Speaker 1: you get a big red icon which says this is
Speaker 1: saying that you're you know, it's going through one of
Speaker 1: the rogue DNS servers. They've also identified a range of
Speaker 1: the IP addresses that you know. You can check your
Speaker 1: DNS settings on your computer yourself. If you're using a
Speaker 1: Windows machine, you go to a run command and you
Speaker 1: type an IP configured slash all uh, and then that'll
Speaker 1: pull up your DNS settings and you can see what
Speaker 1: the what the numeric address is for the server that
Speaker 1: you go to, and if it falls within the rain
Speaker 1: that's been identified by the FBI, you know that your
Speaker 1: DNS settings are wrong. Clearing this up and getting rid
Speaker 1: of the malware is a little tricky. Uh. The easiest
Speaker 1: way I can think of to do it, if I
Speaker 1: were doing it myself, is going to a computer that
Speaker 1: I know has not been affected and downloading the latest
Speaker 1: anti virus software I can find and putting Most of
Speaker 1: them have an option where you can put a version
Speaker 1: of that onto a thumb drive. Do that, then take
Speaker 1: the thumb drive over to the infective machine and booted
Speaker 1: into safe mode and load up the antivirus software from
Speaker 1: the thumb drive, and that should be able. Depending upon
Speaker 1: the anti virus software, it should be able to scan
Speaker 1: it and remove it. Um. The FBI also points to
Speaker 1: several web assets that can help you if your computer
Speaker 1: does appear to be one of the ones that infected,
Speaker 1: and those may work very well for you. I tend
Speaker 1: to go with the anti virus approach whenever I can,
Speaker 1: and UM, it just I don't know, I don't know
Speaker 1: it is. I just have a preference for that as
Speaker 1: opposed to going like a web based route. Yea, um,
Speaker 1: but it is. It is fairly easy to uh to
Speaker 1: get rid of the problem in this case. It's not
Speaker 1: like some of the others where you have to UH
Speaker 1: reformat your hard drive to get it back. Yeah, there's
Speaker 1: there's something. Depending on how tech savvy you are, it's
Speaker 1: pretty easy. If you're not terribly tech savvy, it may
Speaker 1: be it may be worth it to take it to
Speaker 1: a computer professional to have them scan it and remove
Speaker 1: it and take care of it for you, because the
Speaker 1: more you mess with your computer settings, the more you
Speaker 1: may inadvertently cause some problems that can turn your machine
Speaker 1: into a nightmare. Um. And and sometimes depending on the malware,
Speaker 1: like if you've had this on your computer for a while,
Speaker 1: that might not be the only malware that's affecting you.
Speaker 1: You might have other problems, in which case, uh, you know,
Speaker 1: a simple scan and remove may not be enough. In
Speaker 1: a worst case scenario, you might have to do something
Speaker 1: like wipe your computer and reinstall the uprating system, in
Speaker 1: which case the first thing you want to do is
Speaker 1: back up as much of your data as you possibly
Speaker 1: can and then you do the wipe. But that even
Speaker 1: that is I mean, that's that's like a worst case
Speaker 1: scenario type of thing, and hopefully none of our listeners
Speaker 1: are in that. Well. First of all, hopefully none of
Speaker 1: our listeners have been affected by this malware. But if
Speaker 1: they have, hopefully it's not so severe that and they
Speaker 1: don't have other forms of malware that they can't you know, uh,
Speaker 1: take care of it themselves. Yeah. Um. And of course
Speaker 1: it's always a good idea to back up your hard
Speaker 1: drive on a regular basis anyway, just to make sure
Speaker 1: they always back up your hard drive, to to make
Speaker 1: sure that you have a version of your operating system
Speaker 1: uh installed on there that you can go back to
Speaker 1: that you know is not infected at least hopefully. Yeah.
Speaker 1: But that's that's that's pretty impressive. I mean, the FBI
Speaker 1: has really been promoting the fact that they they had
Speaker 1: this success in taking down or apparent success I should say,
Speaker 1: and taking down this uh this ring, this ring, because um,
Speaker 1: you know this is this is pretty significant. They took
Speaker 1: away traffic from uh legitimate websites in addition to making
Speaker 1: money for themselves with the the alternate fake websites. Um.
Speaker 1: And it does expose the fact that most people are
Speaker 1: are you know, still having to uh to think about
Speaker 1: what they do because they they may very well be
Speaker 1: letting somebody in. It could have been a lot worse
Speaker 1: than it was. Yeah, exploiting the DNS system, which again
Speaker 1: I know, redundant at M machine, exploiting that pin number, um,
Speaker 1: it was pretty ingenious, you know. Essentially, it just shows
Speaker 1: that understanding how the Internet works and building this parallel
Speaker 1: system that exploits the way Internet works was very clear.
Speaker 1: Her Now, of course, it's still depended upon user behavior
Speaker 1: to work, because if no one had downloaded the malware,
Speaker 1: if no one had installed the malware, it wouldn't have um,
Speaker 1: nothing would have happened. You would have had these DNS,
Speaker 1: these rogue DNS servers that would be online and would
Speaker 1: be ready to redirect traffic to wherever they wanted it
Speaker 1: to go. But if no one downloaded the malware, the
Speaker 1: traffic would never have been redirected. So really, the other
Speaker 1: lesson to take away from this is just practice good
Speaker 1: Internet security rules of thumb, things like don't open strange
Speaker 1: attachments from you know, in random emails. Make sure you
Speaker 1: ask people if they've sent you an attachment, asked them
Speaker 1: like did you really send this to me? You know,
Speaker 1: because sometimes people their email address gets compromised and they
Speaker 1: randomly start sending out files two people, often in uncharacteristically
Speaker 1: uh worded ways, like you might read and Usage and think,
Speaker 1: either my friend is taking a terrible fall and decided
Speaker 1: to email me immediately afterwards, or is under the influence
Speaker 1: of some powerful alcohol, or you know, it just doesn't
Speaker 1: make any sense, Like you read it and you're like,
Speaker 1: this doesn't sound like Chris. Chris never emails me in
Speaker 1: all caps with lots of letters missing. UM send this
Speaker 1: to everyone you know, UM. Bill Gates will give you
Speaker 1: twenty five cents for every email that you've forward anyway,
Speaker 1: don't don't open those email attachments. Yeah, and you know
Speaker 1: what I've recently realized, Um, every once in a whilehile
Speaker 1: find a story that I want to send to somebody,
Speaker 1: and I've I've realized as I was sending it, I'd say, hey,
Speaker 1: I just saw this, you should check it out. You
Speaker 1: know what? That sounds just like something a spammer would
Speaker 1: writ So I try to make it a little more personally,
Speaker 1: more personal so that the well, for one thing, the
Speaker 1: spam filter will on a lot of these uh services
Speaker 1: will pull it right out of there if you if
Speaker 1: it's something that that minimal, So if it fits that
Speaker 1: pattern of hey I saw this, check it out, and
Speaker 1: then yeah, it can fall into the spam filter pretty easily. Also,
Speaker 1: and it doesn't just go with attachments like I mean,
Speaker 1: or links. Their links, plenty of links are problems. But
Speaker 1: think about like, gosh, I've seen this so many times
Speaker 1: on Facebook, clickjacking on Facebook. So if you've ever gone
Speaker 1: I'm sure most of you have, anyone who's had a
Speaker 1: Facebook account long enough has seen this happen with their friends.
Speaker 1: You'll look and there'll be some video link. You know,
Speaker 1: it'll say it won't be an embedded video, so it's
Speaker 1: not something that plays within Facebook. But you'll see like
Speaker 1: a link to some incredible video and it usually has
Speaker 1: to do with either violence or sex. Those tend to
Speaker 1: be the two big ones. Yeah. Yeah, you go for
Speaker 1: those base instincts that we human have and uh, and
Speaker 1: you get a lot of results, which is kind of
Speaker 1: a sad commentary, but that's a different podcast. Anyway, there's
Speaker 1: a you know, you'll you'll see this link and I
Speaker 1: saw one recently and immediately I was like, my the
Speaker 1: red flag went up. As soon as I saw it.
Speaker 1: First of all, I was like, this doesn't seem like
Speaker 1: the kind of thing this person would have shared, Like
Speaker 1: they might have clicked on a link, but it doesn't
Speaker 1: seem like something they would have themselves shared. And it
Speaker 1: was a supposedly a video about Justin Bieber being stabbed
Speaker 1: at a concert, And as soon as I saw it,
Speaker 1: I thought, Uh, this has click clickjacking written all over it,
Speaker 1: And immediately I went to one of my favorite references
Speaker 1: for this sort of thing, snopes dot com. So Snopes
Speaker 1: is all about urban legends, but they also look at
Speaker 1: things like internet hoaxes and and clickjacking. And I did
Speaker 1: a quick search and sure enough, this is something that's
Speaker 1: been around for a while, and it just it's just
Speaker 1: like a lot of other clickjacking. It has these cycles
Speaker 1: that goes through where you'll have an initial pop up
Speaker 1: of this and then dies down, and then it'll pop
Speaker 1: up again, and I'll do that three or four times. Yeah.
Speaker 1: Current events are often yeah, and I mean it's it's
Speaker 1: you'll find some of these that that have lasted for
Speaker 1: years that basically they don't necessarily have to be about.
Speaker 1: Justin Bieber for example, that maybe the uh, the click
Speaker 1: jack to your Yeah, exactly, or you know, five years
Speaker 1: ago it could have been about for example, Britney Spears. Yeah,
Speaker 1: that would be a very popular one. And Jennifer Aniston
Speaker 1: or somebody somebody that's in the news right that moment. Yeah,
Speaker 1: And it tends to be like or it'll be like
Speaker 1: this this this news anchor had an embarrassing uh moment
Speaker 1: on the news. Click to find out that sort of stuff.
Speaker 1: And what happens is if you do click that, you'll
Speaker 1: get a message that essentially says usually something like, uh,
Speaker 1: your your you need to install this extension or you
Speaker 1: need to install this video player in order to watch
Speaker 1: this video. And if you allow it, then it gets
Speaker 1: at says to things like your Facebook feed and as
Speaker 1: well as possibly other stuff. It may involve other you know,
Speaker 1: kinds of malware, but in general, you've seen see this
Speaker 1: get propagated across Facebook where someone who has fallen from
Speaker 1: the trick agrees to it and then it continues to
Speaker 1: go across Facebook because it starts to use that person's feed.
Speaker 1: So whenever I see one of these, here's what I do, guys.
Speaker 1: I immediately, you know, I see something that that raises
Speaker 1: a red flag like that. First way I do is
Speaker 1: I do a search on Google for whatever the video
Speaker 1: supposedly shows, because nine times out of ten it's just
Speaker 1: completely made up, and you can usually find up. I
Speaker 1: find an article written on it, or it'll be on
Speaker 1: Snopes or something like that where I'll say, you know,
Speaker 1: this new Facebook scam is going around, so watch out
Speaker 1: for it. Once I have confirmed that it's a scam,
Speaker 1: I go back to Facebook and I comment on the
Speaker 1: entry and I say, hey, it looks like this is
Speaker 1: a click jacking attempt. You may want to go and
Speaker 1: and change your Facebook password and delete this post, because
Speaker 1: by deleting the post, you're going to help remove that
Speaker 1: that step for other people to fall victim to that
Speaker 1: same problem. So I do that fairly regularly because I've
Speaker 1: got a lot of friends on Facebook, and this sort
Speaker 1: of thing can happen to anyone. It's uh and and
Speaker 1: it's not necessarily something that's that's sort of either appealing
Speaker 1: to violence or sex. Sometimes it's something that's just interesting
Speaker 1: and it has nothing to do with any of those
Speaker 1: uh uh kind of more base subject matter writing. And also,
Speaker 1: I mean in general, when there's a link in Facebook,
Speaker 1: if it's a link in Facebook, I tend to go
Speaker 1: to Google anyway and try and get to that link
Speaker 1: without going through Facebook, because you never know when it's
Speaker 1: a clickjacking attempt. If it's an embedded video within Facebook,
Speaker 1: like a YouTube video that's been embedded in Facebook something
Speaker 1: like that, I'm all right with that. I'll watch it
Speaker 1: that way. But for links, I tend to go outside
Speaker 1: of Facebook to do it, just to be on the
Speaker 1: safe side, which I'm sure Facebook hates. That's not what
Speaker 1: Facebook wants to hear. But until they want to track you, right,
Speaker 1: until there's better security around that so that I'm not
Speaker 1: throwing caution to the wind and infecting my computer. I
Speaker 1: just I can't justify it. So that's just my own
Speaker 1: personal approach. Guys, I'm sure all of you probably have
Speaker 1: your own sort of way of dealing with this and
Speaker 1: avoiding problems, but it's always something that's good to keep
Speaker 1: in mind. Uh and um. Anyway, So if you, guys,
Speaker 1: suspect that you might have this DNS change your malware
Speaker 1: on your computer, go to the FBI's website. Use their
Speaker 1: tool first of all to see if you get a
Speaker 1: result back. If you don't get a result back, you're
Speaker 1: probably okay, not necessarily okay. You can pull up that
Speaker 1: list of addresses that do map to these rogue servers
Speaker 1: and go through your computer settings and confirm it that way,
Speaker 1: warning rogue servers. So just check your computers, make sure
Speaker 1: you're you're fine, because if you're not fine, then once
Speaker 1: the FBI turns these servers off, you may have some
Speaker 1: problems accessing stuff over the web, and then you're thinking,
Speaker 1: what the heck happened? And the real nasty part about
Speaker 1: not being able to access the web is not being
Speaker 1: able to access Why you can't access the web I've
Speaker 1: had that happen. Apparently, did I not pay my internet bill?
Speaker 1: Is my router down? I don't know how to check
Speaker 1: because I can't look anything up. Yes, I'm that guy anyway.
Speaker 1: So do you have anything else you want to add
Speaker 1: about this? Not really, not really know, So let us
Speaker 1: wrap this up. Guys, if you have any suggestions for
Speaker 1: future topics on tech Stuff podcasts, you can let us
Speaker 1: know through email that addresses tech stuff add discovery dot
Speaker 1: com or you less know on Facebook or Twitter or
Speaker 1: handle us both those social networks. Is text stuff each
Speaker 1: s W and Chris and I will talk to you
Speaker 1: again really soon. For more on this and thousands of
Speaker 1: other topics, visit how stuff Works dot com. Brought to
Speaker 1: you by the reinvented two thousand twelve camera. It's ready,
Speaker 1: are you